2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../lib/tsocket/tsocket.h"
26 #include "../librpc/ndr/libndr.h"
28 extern fstring remote_proto
;
31 * this is the entry point if SMB2 is selected via
32 * the SMB negprot and the given dialect.
34 static void reply_smb20xx(struct smb_request
*req
, uint16_t dialect
)
40 size_t len
= SMB2_HDR_BODY
+ 0x24 + 2;
42 smb2_inpdu
= talloc_zero_array(talloc_tos(), uint8_t, len
);
43 if (smb2_inpdu
== NULL
) {
44 DEBUG(0, ("Could not push spnego blob\n"));
45 reply_nterror(req
, NT_STATUS_NO_MEMORY
);
48 smb2_hdr
= smb2_inpdu
;
49 smb2_body
= smb2_hdr
+ SMB2_HDR_BODY
;
50 smb2_dyn
= smb2_body
+ 0x24;
52 SIVAL(smb2_hdr
, SMB2_HDR_PROTOCOL_ID
, SMB2_MAGIC
);
53 SIVAL(smb2_hdr
, SMB2_HDR_LENGTH
, SMB2_HDR_BODY
);
55 SSVAL(smb2_body
, 0x00, 0x0024); /* struct size */
56 SSVAL(smb2_body
, 0x02, 0x0001); /* dialect count */
58 SSVAL(smb2_dyn
, 0x00, dialect
);
62 smbd_smb2_first_negprot(req
->xconn
, smb2_inpdu
, len
);
67 * this is the entry point if SMB2 is selected via
68 * the SMB negprot and the "SMB 2.002" dialect.
70 void reply_smb2002(struct smb_request
*req
, uint16_t choice
)
72 reply_smb20xx(req
, SMB2_DIALECT_REVISION_202
);
76 * this is the entry point if SMB2 is selected via
77 * the SMB negprot and the "SMB 2.???" dialect.
79 void reply_smb20ff(struct smb_request
*req
, uint16_t choice
)
81 struct smbXsrv_connection
*xconn
= req
->xconn
;
82 xconn
->smb2
.allow_2ff
= true;
83 reply_smb20xx(req
, SMB2_DIALECT_REVISION_2FF
);
86 enum protocol_types
smbd_smb2_protocol_dialect_match(const uint8_t *indyn
,
87 const int dialect_count
,
91 enum protocol_types proto
;
94 { PROTOCOL_SMB3_00
, SMB3_DIALECT_REVISION_300
},
95 { PROTOCOL_SMB2_24
, SMB2_DIALECT_REVISION_224
},
96 { PROTOCOL_SMB2_22
, SMB2_DIALECT_REVISION_222
},
97 { PROTOCOL_SMB2_10
, SMB2_DIALECT_REVISION_210
},
98 { PROTOCOL_SMB2_02
, SMB2_DIALECT_REVISION_202
},
102 for (i
= 0; i
< ARRAY_SIZE(pd
); i
++) {
105 if (lp_server_max_protocol() < pd
[i
].proto
) {
108 if (lp_server_min_protocol() > pd
[i
].proto
) {
112 for (c
= 0; c
< dialect_count
; c
++) {
113 *dialect
= SVAL(indyn
, c
*2);
114 if (*dialect
== pd
[i
].dialect
) {
120 return PROTOCOL_NONE
;
123 NTSTATUS
smbd_smb2_request_process_negprot(struct smbd_smb2_request
*req
)
125 struct smbXsrv_connection
*xconn
= req
->xconn
;
127 const uint8_t *inbody
;
128 const uint8_t *indyn
= NULL
;
131 DATA_BLOB negprot_spnego_blob
;
132 uint16_t security_offset
;
133 DATA_BLOB security_buffer
;
134 size_t expected_dyn_size
= 0;
136 uint16_t security_mode
;
137 uint16_t dialect_count
;
138 uint16_t in_security_mode
;
139 uint32_t in_capabilities
;
140 DATA_BLOB in_guid_blob
;
142 uint16_t dialect
= 0;
143 uint32_t capabilities
;
144 DATA_BLOB out_guid_blob
;
145 struct GUID out_guid
;
146 enum protocol_types protocol
= PROTOCOL_NONE
;
148 uint32_t max_trans
= lp_smb2_max_trans();
149 uint32_t max_read
= lp_smb2_max_read();
150 uint32_t max_write
= lp_smb2_max_write();
151 NTTIME now
= timeval_to_nttime(&req
->request_time
);
153 status
= smbd_smb2_request_verify_sizes(req
, 0x24);
154 if (!NT_STATUS_IS_OK(status
)) {
155 return smbd_smb2_request_error(req
, status
);
157 inbody
= SMBD_SMB2_IN_BODY_PTR(req
);
159 dialect_count
= SVAL(inbody
, 0x02);
161 in_security_mode
= SVAL(inbody
, 0x04);
162 in_capabilities
= IVAL(inbody
, 0x08);
163 in_guid_blob
= data_blob_const(inbody
+ 0x0C, 16);
165 if (dialect_count
== 0) {
166 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
169 status
= GUID_from_ndr_blob(&in_guid_blob
, &in_guid
);
170 if (!NT_STATUS_IS_OK(status
)) {
171 return smbd_smb2_request_error(req
, status
);
174 expected_dyn_size
= dialect_count
* 2;
175 if (SMBD_SMB2_IN_DYN_LEN(req
) < expected_dyn_size
) {
176 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
178 indyn
= SMBD_SMB2_IN_DYN_PTR(req
);
180 protocol
= smbd_smb2_protocol_dialect_match(indyn
,
184 for (c
=0; protocol
== PROTOCOL_NONE
&& c
< dialect_count
; c
++) {
185 if (lp_server_max_protocol() < PROTOCOL_SMB2_10
) {
189 dialect
= SVAL(indyn
, c
*2);
190 if (dialect
== SMB2_DIALECT_REVISION_2FF
) {
191 if (xconn
->smb2
.allow_2ff
) {
192 xconn
->smb2
.allow_2ff
= false;
193 protocol
= PROTOCOL_SMB2_10
;
199 if (protocol
== PROTOCOL_NONE
) {
200 return smbd_smb2_request_error(req
, NT_STATUS_NOT_SUPPORTED
);
203 if (get_remote_arch() != RA_SAMBA
) {
204 set_remote_arch(RA_VISTA
);
207 fstr_sprintf(remote_proto
, "SMB%X_%02X",
208 (dialect
>> 8) & 0xFF, dialect
& 0xFF);
210 reload_services(req
->sconn
, conn_snum_used
, true);
211 DEBUG(3,("Selected protocol %s\n", remote_proto
));
213 /* negprot_spnego() returns a the server guid in the first 16 bytes */
214 negprot_spnego_blob
= negprot_spnego(req
, xconn
);
215 if (negprot_spnego_blob
.data
== NULL
) {
216 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
219 if (negprot_spnego_blob
.length
< 16) {
220 return smbd_smb2_request_error(req
, NT_STATUS_INTERNAL_ERROR
);
223 security_mode
= SMB2_NEGOTIATE_SIGNING_ENABLED
;
224 if (lp_server_signing() == SMB_SIGNING_REQUIRED
) {
225 security_mode
|= SMB2_NEGOTIATE_SIGNING_REQUIRED
;
229 if (lp_host_msdfs()) {
230 capabilities
|= SMB2_CAP_DFS
;
233 if (protocol
>= PROTOCOL_SMB2_10
&&
235 lp_oplocks(GLOBAL_SECTION_SNUM
) &&
236 !lp_kernel_oplocks(GLOBAL_SECTION_SNUM
))
238 capabilities
|= SMB2_CAP_LEASING
;
241 if ((protocol
>= PROTOCOL_SMB2_24
) &&
242 (lp_smb_encrypt(-1) != SMB_SIGNING_OFF
) &&
243 (in_capabilities
& SMB2_CAP_ENCRYPTION
)) {
244 capabilities
|= SMB2_CAP_ENCRYPTION
;
248 * 0x10000 (65536) is the maximum allowed message size
253 if (protocol
>= PROTOCOL_SMB2_10
) {
256 if (tsocket_address_is_inet(req
->sconn
->local_address
, "ip")) {
257 p
= tsocket_address_inet_port(req
->sconn
->local_address
);
260 /* largeMTU is not supported over NBT (tcp port 139) */
261 if (p
!= NBT_SMB_PORT
) {
262 capabilities
|= SMB2_CAP_LARGE_MTU
;
263 xconn
->smb2
.credits
.multicredit
= true;
266 * We allow up to almost 16MB.
268 * The maximum PDU size is 0xFFFFFF (16776960)
269 * and we need some space for the header.
271 max_limit
= 0xFFFF00;
276 * the defaults are 8MB, but we'll limit this to max_limit based on
277 * the dialect (64kb for SMB 2.0, 8MB for SMB >= 2.1 with LargeMTU)
279 * user configured values exceeding the limits will be overwritten,
280 * only smaller values will be accepted
283 max_trans
= MIN(max_limit
, lp_smb2_max_trans());
284 max_read
= MIN(max_limit
, lp_smb2_max_read());
285 max_write
= MIN(max_limit
, lp_smb2_max_write());
287 if (capabilities
& SMB2_CAP_ENCRYPTION
) {
288 xconn
->smb2
.server
.cipher
= SMB2_ENCRYPTION_AES128_CCM
;
291 security_offset
= SMB2_HDR_BODY
+ 0x40;
294 /* Try SPNEGO auth... */
295 security_buffer
= data_blob_const(negprot_spnego_blob
.data
+ 16,
296 negprot_spnego_blob
.length
- 16);
298 /* for now we want raw NTLMSSP */
299 security_buffer
= data_blob_const(NULL
, 0);
302 out_guid_blob
= data_blob_const(negprot_spnego_blob
.data
, 16);
303 status
= GUID_from_ndr_blob(&out_guid_blob
, &out_guid
);
304 if (!NT_STATUS_IS_OK(status
)) {
305 return smbd_smb2_request_error(req
, status
);
308 outbody
= smbd_smb2_generate_outbody(req
, 0x40);
309 if (outbody
.data
== NULL
) {
310 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
313 SSVAL(outbody
.data
, 0x00, 0x40 + 1); /* struct size */
314 SSVAL(outbody
.data
, 0x02,
315 security_mode
); /* security mode */
316 SSVAL(outbody
.data
, 0x04, dialect
); /* dialect revision */
317 SSVAL(outbody
.data
, 0x06, 0); /* reserved */
318 memcpy(outbody
.data
+ 0x08,
319 out_guid_blob
.data
, 16); /* server guid */
320 SIVAL(outbody
.data
, 0x18,
321 capabilities
); /* capabilities */
322 SIVAL(outbody
.data
, 0x1C, max_trans
); /* max transact size */
323 SIVAL(outbody
.data
, 0x20, max_read
); /* max read size */
324 SIVAL(outbody
.data
, 0x24, max_write
); /* max write size */
325 SBVAL(outbody
.data
, 0x28, now
); /* system time */
326 SBVAL(outbody
.data
, 0x30, 0); /* server start time */
327 SSVAL(outbody
.data
, 0x38,
328 security_offset
); /* security buffer offset */
329 SSVAL(outbody
.data
, 0x3A,
330 security_buffer
.length
); /* security buffer length */
331 SIVAL(outbody
.data
, 0x3C, 0); /* reserved */
333 outdyn
= security_buffer
;
335 req
->sconn
->using_smb2
= true;
337 if (dialect
!= SMB2_DIALECT_REVISION_2FF
) {
338 status
= smbXsrv_connection_init_tables(xconn
, protocol
);
339 if (!NT_STATUS_IS_OK(status
)) {
340 return smbd_smb2_request_error(req
, status
);
343 xconn
->smb2
.client
.capabilities
= in_capabilities
;
344 xconn
->smb2
.client
.security_mode
= in_security_mode
;
345 xconn
->smb2
.client
.guid
= in_guid
;
346 xconn
->smb2
.client
.num_dialects
= dialect_count
;
347 xconn
->smb2
.client
.dialects
= talloc_array(xconn
,
350 if (xconn
->smb2
.client
.dialects
== NULL
) {
351 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
353 for (c
=0; c
< dialect_count
; c
++) {
354 xconn
->smb2
.client
.dialects
[c
] = SVAL(indyn
, c
*2);
357 xconn
->smb2
.server
.capabilities
= capabilities
;
358 xconn
->smb2
.server
.security_mode
= security_mode
;
359 xconn
->smb2
.server
.guid
= out_guid
;
360 xconn
->smb2
.server
.dialect
= dialect
;
361 xconn
->smb2
.server
.max_trans
= max_trans
;
362 xconn
->smb2
.server
.max_read
= max_read
;
363 xconn
->smb2
.server
.max_write
= max_write
;
366 return smbd_smb2_request_done(req
, outbody
, &outdyn
);